Two 3015's: How do I configure for hot failover?

[wrickk_2]

I have two VPN3015's. One is live and the other we use as a backup. Is there a way to configure them so if the primary device fails the secondary device will automatically become the primary device and provide a high availability solution for our tunnels?

[gfullage · Accepted solution]

Sure, you can do this either in a master/slave backup scenario, or in a load-sharing scenario. Personally I like using load-balancing where your clients are evenly distributed over the two concentrators, rather than have them all connect to the master. This way if one concentrator dies only half your users are affected, but they can then log straight back in to the other concentrator without changing anything on the client.

You can read about load-balancing here:

http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/4_0/config/lbssf.htm

and about redundancy here:

http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/4_0/config/iprout.htm#1012150

Note you cannot have both load-balancing and redundancy enabled, it's either one or the other.

[wrickk_2]

Excellent, thank you.